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Abstract 



In this paper we study the implementation challenge in an abstract interdependent values 
model and an arbitrary objective function. We design a mechanism that allows for approximate 
optimal implementation of insensitive objective functions in ex-post Nash equilibrium. If, 
furthermore, values are private then the same mechanism is strategy proof. We cast our results 
onto two specific models: pricing and facility location. The mechanism we design is optimal 
up to an additive factor of the order of magnitude of one over the square root of the number of 
agents and involves no utility transfers. 

Underlying our mechanism is a lottery between two auxiliary mechanisms — with high 
probability we actuate a mechanism that reduces players influence on the choice of the social 
alternative, while choosing the optimal outcome with high probability. This is where the recent 
notion of differential privacy is employed. With the complementary probability we actuate a 
mechanism that is typically far from optimal but is incentive compatible. The joint mechanism 
inherits the desired properties from both. 
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1 Introduction 



Mechanism design deals with the implementation of desired outcomes in a multi-agent system with 
asymmetric information. The outcome of a mechanism may be a price for a good, an allocation 
of goods to the agents, the decision on a provision of a public good, locating public facilities, 
etc. The quality of the outcome is measured by some objective function. In many instances the 
literature is concerned with the sum of the agents' valuations for an outcome, but the objective 
function can take many other forms, such as the revenue of a seller in an auction setting, the social 
inequality in a market setting and more. The reader is referred to Mas-Colell, Whinston and Green 
|fT9l for a broader introduction. The holy grail of the mechanism design challenge is to design 
mechanisms which exhibit dominant strategies for the players, and furthermore, once players play 
their dominant strategies the outcome of the mechanism coincides with maximizing the objective 
function. Broadly speaking, this challenge is equivalent to designing optimal direct mechanisms 
that are truthful. 

As it turns out, such powerful mechanisms do not exist in general. The famous Gibbard- 
Satterthwaite theorem (Gibbard lfl4l and Satterthwaite ||29l ) tells us that for non-restricted settings 
any non-trivial truthful mechanism is dictatorial. However, if we restrict attention to the objective 
function that is simply the sum of the agents' valuations, then this problem can be overcome 
by introducing monetary payments. Indeed, in such cases the celebrated Vickrey-Clarke-Groves 
mechanisms, discovered by Vickrey ||371 and generalized by Clarke (HI and Groves lfT6ll , guarantee 
that being truthful is a dominant strategy and the outcome is optimal. Unfortunately, Roberts E6l 
showed that a similar mechanism cannot be obtained for other objective functions. This cul-de-sac 
induced researchers to 'lower the bar' for mechanism design. One possibility for lowering the bar 
is to replace the solution concept with a weaker one and a large body of literature on Bayes-Nash 
implementation has developed (the reader is referred to Mas-Colell et al. [19] for further reading). 

Another direction is that of approximate implementation where the quest replaces accurate 
implementation with approximate implementation, while keeping the approximation inaccuracy 
as low as possible. The latter research agenda turned out to be fruitful and yielded many positive 
results. A sequence of papers on virtual implementation, initiated by Matsushima EOl and Abreu 
and Sen [2], provides general conditions for approximate implementation where the approximation 
inaccuracy in a fixed model can be made arbitrarily small. On the other hand, the recent literature 
emerging from the algorithmic mechanism design community looks at approximation inaccuracies 
which are a function of the size of the model (measured, e.g., the number of agents). 

Interestingly, no general techniques are known for designing mechanisms that are approxi- 
mately optimal for arbitrary social welfare functions. To demonstrate this consider the facility 
location problem, where a social planner needs to locate some facilities, based on agents' reports 
of their own location. This problem has received extensive attention recently, yet small changes in 
the model result in different techniques which seem tightly tailored to the specific model assump- 
tions (see Alon et al. [5], Procaccia and Tennenholtz ||25l and Wang et al. 11381 ). 



1 



Another line of research, initiated by Moulin [23], is that on mechanism design without money. 
Moulin, and later Schummer and Vohra ||3~2l [331 , characterized functions that are truthfully im- 
plementable without payments and studied domains in which non-dictatorial functions can be im- 
plemented. More recently, Procaccia and Tennenholtz G51 studied a relaxation of this notion - 
approximate mechanism design without money. 

Our work presents a general methodology for designing approximately optimal mechanisms 
for a broad range of models, including the facility location problem. A feature of our constructions 
is that the resulting mechanisms do not involve monetary transfers. 



1.1 Our Contribution 

We introduce an abstract mechanism design model where agents have interdependent values and 
provide a generic technique for approximate implementation of an arbitrary objective function. 
More precisely, we bound the worst case difference between the optimal outcome ('first best') and 

the expected outcome of our generic mechanism by 0(^J~^), where n is the population size. In 
addition, our generic construction does not involve utility transfer. 

Our construction combines two very different random mechanisms: 

• With high probability we deploy a mechanism that chooses social alternatives with a prob- 
ability that is proportional to (the exponent of) the outcome of the objective function, as- 
suming players are truthful. This mechanism exhibits two important properties. First, agents 
have small influence on the outcome of the mechanism and consequently have little influence 
on their own utility. As a result all strategies, including truthfulness, are e-dominant. Second, 
under the assumption that players are truthful, alternatives which are nearly optimal are most 
likely to be chosen. The concrete construction we use follows the Exponential Mechanism 
presented by McSherry and Talwar Il22l . 

• With vanishing probability we deploy a mechanism which is designed with the goal of elic- 
iting agents' private information, while ignoring the objective function. 

Our technique is developed for settings where the agents' type spaces as well as the set of social 
alternatives are finite. In more concrete settings, however, our techniques extend to 'large' type 
sets. We demonstrate our results in two specific settings: (1) Facility location problems, where 
the social planner is tasked with the optimal location of K facilities in the most efficient way. In 
this setting we focus on minimizing the social cost which is the sum of agents' distances from 
the nearest facility. (2) The digital goods pricing model, where a monopolist needs to determine 
the price for a digital good (goods with zero marginal cost for production) in order to maximize 
revenue. 
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Another contribution of our work is an extension of the classical social choice model. In 
the classical model agents' utilities are expressed as a function of the private information and 
a social alternative, a modeling that abstracts away the issue of how agents exploit the social 
choice made. We explicitly model this by extending the standard model by an additional stage, 
following the choice of the social alternative, where agents take an action to exploit the social 
alternative and determine their utility (hereinafter 'reaction'). We motivate this extension to the 
standard model with the following examples: (1) In a Facility Location problem agents react to the 
mechanism's outcome by choosing one of the facilities (e.g., choose which school to attend). (2) A 
Monopolist posts a price based on agents input. Agents react by either buying the good or not. (3) 
In an exchange economy agents react to the price vector (viewed as the outcome of the invisible 
hand mechanism) by demanding specific bundles. (4) In a public good problem, where a set of 
substitutable goods is supplied, each agent must choose her favorite good. (5) Finally, consider 
a network design problem, where each agent must choose the path it will use along the network 
created by the society. These examples demonstrate the prevalence of 'reactions' in a typical design 
problem^ With this addendum to the model one can enrich the notion of a mechanism; in addition 
to determining a social choice the mechanism can also restrict the set of reactions available to an 
agent. For example, in the context of school location, the central planner can choose where to build 
new schools and, in addition, impose the specific school assigned to each student. We refer to this 
aspect of mechanisms as imposition. 

We demonstrate the notion of imposition with the following illustrative example: 

Example 1 In time of depression the government proposes to subsidize some retraining programs. 
There are three possible programs from which the government must choose two due to budget 
constraints. Once a pair of programs is chosen each agent is allocated to her favorite program. For 
simplicity, assume each candidate for retraining has a strict preference over the three programs, 
with utilities equal 1, 2 and 3. Assume the government wants to maximize the social welfare subject 
to its budget constraint. A naive approach in which the government chooses the pair that maximizes 
the overall grade is clearly manipulable (there may be settings where an agent will falsely down- 
grade his 2nd choice to the third place in order to ensure his first choice makes it). An alternative 
methodology is for the government to choose a pair randomly, where the probability assigned to 
each pair is an increasing function of its induced welfare (the specific nature of the function will be 
made clear in the sequel). In addition, with a vanishing probability, a random pair will be chosen 
and in that case each agent will assigned her preferred program according to her announcement. 

It turns out that this scheme is not manipulable and agents' optimal strategy is to report truth- 
fully. If the population is large enough then the probability of choosing the truly optimal pair can 
be made arbitrarily close to one. 

'Formally, the introduction of reactions only generalizes the model. In fact, if we assume that the set of reactions 
is a singleton then we are back to the classical model. Additionally, it could be argued that reactions can be modeled 
as part of the set social alternatives, S. For the analysis and mechanism we propose the distinction between the set S 
and the reactions is important. 
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1.2 Related Work 



Virtual implementation. The most closely related body of work is the literature on 'virtual im- 
plementation' with incomplete information, derived from earlier work on virtual implementation 
with complete information which was initiated by Matsushima [20] and Abreu and Sen 0. A 
social choice function is virtually implementable if for any e > there exists a mechanism which 
equilibria result in outcomes that e-approximate the function. Results due to Abreu and Mat- 
sushima [1], Duggan [9] and Serrano and Vohra ll34l l35l provide necessary and sufficient condi- 
tions for functions to be virtually implementable in various environments with private information. 
A common thread throughout the results on virtual implementation under incomplete information 
is the incentive compatibility requirement over the social choice function, in addition to some 
form of type diversity. Compared with our contribution the above mentioned work provides posi- 
tive results in environments with small populations, whereas we require large populations in order 
to have a meaningful approximation. On the other hand, the solution concepts we focus on are 
ex-post Nash equilibrium, undominated strategies, and strict dominance (for the private values set- 
ting), compared with iterated deletion of dominated strategies or Bayes-Nash equilibria, provided 
in the above mentioned papers. In addition, the virtual implementation results apply to functions 
that are incentive compatible from the outset, whereas our technique applies to arbitrary objective 
functions. In both cases the mechanisms proposed do not require transfers but do require some 
kind of type diversity. 



Influence and Approximate Efficiency. The basic driving force underlying our construction 
is ensuring that each agent has a vanishing influence on the outcome of the mechanism as the 
population grows. In the limit, if players are non-influential, then they might as well be truthful. 
This idea is not new and has been used by various authors to provide mechanisms that approximate 
efficient outcomes when the population of players is large. Some examples of work that hinge 
on a similar principle for large, yet finite populations, are Swinkels [|36l who studies auctions, 
Satterthwaite and Williams 11301 and Rustichini, Satterthwaite and Williams 11281 who study double 
auctions, and Al-Najjar and Smorodinsky [4J who study an exchange market. The same principle 
is even more enhanced in models with a continuum of players, where each agent has no influence 
on the joint outcome (e.g., Roberts and Postlewaite [27] who study an exchange economy). The 
mechanisms provided in these papers are designed for maximizing the sum of agents' valuations, 
and provide no value for alternative objective functions. In contrast, our results hold a for a wide 
range of objective functions and are generic in nature. Interestingly, a similar argument, hinging 
on players' lack of influence, is instrumental to show inefficiency in large population models (for 
example, Mailath and Postlewaite ffT8l demonstrate 'free-riding' in the context of public goods, 
which eventually leads to inefficiency). 

A formal statement of 'influence' in an abstract setting appears in Levine and Pesendorfer [fTTl 
and Al-Najjar and Smorodinsky [3]. Beyond the formalization of influence these works provide 
bounds on aggregate measures of influence such as the average influence or on the number of 
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influential agents. McLean and Postlewaite [21] introduce the notion of informational smallness, 
formalizing settings where one player's information is insignificant with respect to the aggregated 
information. 



Differential Privacy. The notion of differential privacy, recently introduced by Dwork, McSh- 
erry, Nissim and Smith [12), captures a measure of (lack of) privacy by the impact of a single 
agent's input on the outcome of a joint computation. A small impact suggests that the agent's 
privacy cannot be significantly jeopardized. In the limit, if an agent has no impact then nothing 
can be learned about the agent from the outcome of the computation. More accurately, differential 
privacy stipulates that the influence of any contributor to the computation is bounded in a very 
strict sense: any change in the input contributed by an individual translates to at most a near-one 
multiplicative factor in the probability distribution over the set of outcomes H 

The scope of computations that were shown to be computed in a differentially private manner 
has grown significantly since the introduction of the concept and the reader is referred to Dwork 
ifTTI for a recent survey. 

McSherry and Talwar [|22l establish an inspiring connection between differential privacy and 
mechanism design, where differential privacy is used as a tool for constructing efficient mecha- 
nisms. They observe that participants (players) that contribute private information to e-differentially 
private computations have limited influence on the outcome of the computation, and hence have 
a limited incentive to lie, even if their utility is derived from the joint outcome. Consequently, 
truth-telling is approximately dominant in mechanisms that are e-differentially private, regardless 
of the agent utility functions^ McSherry and Talwar introduce the exponential mechanism as a 
generic e-differentially private mechanism. In addition, they show that whenever agents are truth- 
ful the exponential mechanism chooses a social alternative which almost optimizes the objective 
function. They go on and demonstrate the power of this mechanism in the context of Unlimited 
Supply Auctions, Attribute Auctions, and Constrained pricing. 

The contribution of McSherry and Talwar leaves much to be desired in terms of mechanism de- 
sign: (1) It is not clear how to set the value of e. Lower values of e imply higher compatibility with 
incentives, on the one hand, but deteriorate the approximation results on the other hand. The model 
and results of McSherry and Talwar do not provide a framework for analyzing these countervailing 
forces. (2) Truth telling is approximately dominant, but, in fact, in the mechanisms they design 
all strategies are approximately dominant, which suggests that truth telling may have no intrin- 
sic advantage over any other strategy in their mechanism. (3) Furthermore, one can demonstrate 
that misreporting one's private information can actually dominate other strategies, truth-telling in- 
cluded. To make things worse, such dominant strategies may lead to inferior results for the social 
planner. This is demonstrated in Example[2l in the context of monopoly pricing. 

2 The measure of 'impact' underlying differential privacy is the analog of 'influence' a-la Levine and Pesendor- 
fer |[r7l and Al-Najjar and Smorodinsky J5) in a non-Bayesian framework, with worst-case considerations. 
3 Schummer iFJTl also studies approximately dominant strategies, in the context of exchange economies. 
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Facility Location. One of the concrete examples we investigate is the optimal location of facil- 
ities. The facility location problem has already been tackled in the context of approximate mech- 
anism design without money, and turned out to lead to interesting challenges. While the single 
facility location problem exhibits preferences that are single-peaked and can be solved optimally 
by selecting the median declaration, the 2-facility problem turns out to be non-trivial. Most recently 
Wang et al ||38l introduce a randomized 4-(multiplicative) approximation truthful mechanism for 
the 2 facility location problem. The techniques introduced here provide much better approxima- 
tions - in particular we provide an additive 0(n -1 / 3 ) approximation to the average optimal distance 
between the agents and the facilities 

Following our formalization of reactions and of imposition and its applicability to facility lo- 
cation, Fotakis and Tzamos |[T3l provide 'imposing' versions of previously known mechanisms to 
improve implementation accuracy. They provide constant multiplicative approximation or loga- 
rithmic multiplicative approximation, albeit with fully imposing mechanisms. 



Non discriminatory Pricing of Digital Goods. Another concrete setting where we demonstrate 
our generic results is a pricing application, where a monopolist sets a single price for goods with 
zero marginal costs ("digital goods") in order to maximize revenues. We consider environments 
where the potential buyers have interdependent valuations for the good. Pricing mechanisms for 
the private values case have been studied by Goldberg et al lfT5l and Balcan et al 0. They consider 
settings where agents' valuation are not necessarily restricted to a finite set and achieve 0{-^=)- 
implementation (where n is the population size). Whereas our mechanism provides a similar bound 
it is limited to settings with finitely many possible prices. However, it is derived from general 
principles and therefore more robust. In addition, our mechanism is applicable beyond the private 
values' setting. 



2 Model 



2.1 The Environment 

Let iV denote a set of n agents, S denotes & finite set of social alternatives and 7$, i = 1, . . . , n, 
is a finite type space for agent i. We denote by T = x" =1 Tj the set of type tuples and write 
TLj = Xj^Tj with generic element Agent i's type, t { E T i5 is her private information. Let 
Ri be the set of reactions available to i. Typically, once a social alternative, s G S, is determined 
agents choose a reaction r« e Ri. The utility of an agent i is therefore a function of the vector of 

4 The notation 0(n _1 ) is used to denote convergence to zero at a rate Mpl. Compared with 0(n _1 ) which denotes 
convergence to zero at a rate — 
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types, the chosen social alternative and the chosen reaction. Formally, itj : T X S X R4 — > [0, l]o 
A tuple (T, S, R, u), where R = x" =1 i?j and u — (ui , . . . , u n ), is called an environment. We will 
use ri(t, s) to denote an arbitrary optimal reaction for agent i (i.e., r^t, s) is an arbitrary function 
which image is in the set argmax r . £R .Ui(t, s, Ti)). 

We say that an agent has private reactions if her optimal reaction of i depends only only on her 
type and the social alternative. Formally, agent i has private reactions if argmax r&R Mi{{ti, t-i), s, Ti) = 
argmax r . £R .Ui((ti, s, r{), for all s, i, U, t-i and t'_j. To emphasize that rj(t, s) does not depend 
on t_j we will use in this case the notation s) to denote an arbitrary optimal reaction for agent 
i. We say that an agent has private values if she has private reactions and furthermore her utility 
depends only on her type, social alternative and reaction, i.e., Ui((U, t-i), s, = Ui((U, s, r{) 
for all s, i, U, t-i and t'^. In this case we will use the notation Ui(U, s, r») to denote the agent's 
utility, to emphasize that it does not depend on t-i. In the more general setting, where the utility 
Ui and the optimal reaction may depend on t-i, we say that agents have interdependent values. 

An environment is non-trivial if for any pair of types there exists a social alternative for which 
the optimal reactions are distinct. Formally, Vz, t{ 7^ t{ E Tj and t-i there exists s E S, denoted 

s(U, U, t-i), such that argmax r . eR .Ui((ti, t-i), s, n) fl argmax r . eR .Ui((ti, t-i), s, n) = 0. We say 
that s(ti,ii,t-i) separates between ti and U at t-i. A set of social alternatives, S C S is called 
separating if for any % and ti ^ U and t-i, there exists some s(U, U, t-i) E S that separates between 
ti and ti at t-i. 



2.2 The Objective Function 

A social planner, not knowing the vector of types, wants to maximize an arbitrary objective function 
(sometimes termed social welfare function), F : T x S — > [0, 1] @ We focus our attention on a class 
of functions for which individual agents have a diminishing impact, as the population size grows: 

Definition 1 (Sensitivity) The objective function F : T x S — > [0, 1] is <i-sensitive ifii, ti ^ U, t-i 
and s E S, \F((ti, t-i), s) — F((ii, t-i), s)\ < -, where n is the population size% 

Note that this definition refers to unilateral changes in announcements, while keeping the social 
alternative fixed. In particular d- sensitivity does not exclude the possibility of a radical change in 

5 Utilities are assumed to be bounded in the unit interval. This is without loss of generality, as long as there is some 
uniform bound on the utility. 

6 In fact, one can consider objective functions of the form F : T x S x R [0, 1] . Our results go through if for any 
t and s and any i and r_; the functions F(t, s, {r-i, •)) : i?; — > [0, 1] and Ui(t, s, ■) : Ri — > [0, 1] are co-monotonic. 
In words, as long as the objective function's outcome (weakly) increases whenever a change in reaction increases an 
agent's utility. 

7 In the definition of sensitivity one can replace the constant d with a function d = d(n) that depends on the 
population size. Our go through for the more general case as long as lim n _ i . 00 = 0. 



7 



the optimal social alternative as a result of unilateral deviations, which, in turn, can radically 
change the utility of the player. Thus, this definition is mute in the context of the influence of an 
agent on her own utility. 

One commonly used objective function which is 1- sensitive is the average utility, 

F , t x = E^»(M,^(t, s)) 
n 

Note that a d- sensitive function eliminates situations where any single agent has an overwhelming 
impact on the value of the objective function, for a fixed social alternative s. In fact, if an objective 
function is not <i-sensitive, for any d, then in a large population this function could be susceptible 
to minor faults in the system (e.g., noisy communication channels)^ 



2.3 Mechanisms 

Denote by IZi = 2 Rl \ {0} the set of all subsets of Ri, except for the empty set, and let 1Z = x{R,i. 

A (direct) mechanism randomly chooses, for any vector of inputs t a social alternative, and for 
each agent % a subset of available reactions. Formally: 

Definition 2 (Mechanism) A (direct) mechanism is a function M : T — > A(S x TV). 

In addition, the mechanism discloses the vector of agents' announcements, and agents can use 
this information to choose a reaction^ 

We denote by Ms(t) the marginal distribution of M(t) on S and by Mj(t) the marginal dis- 
tribution on IZi. We say that the mechanism M is non-imposing if Mi(t)(Ri) = 1. That is, the 
probability assigned to the grand set of reactions is one, for all i and t E T. Put differently, the 
mechanism never restricts the set of available reactions. M is e-imposing if Mi(t)(Ri) > 1 — e for 
all % and t 6 T. In words, with probability exceeding 1 — e the mechanism imposes no restrictions. 



2.4 Strategies and Solution Concepts 

A mechanism induces the following game with incomplete information. In the first phase agents 
announce their types simultaneously to the mechanism. Then the mechanism chooses a social 

8 An example of a function that is not <i-sensitive, for any d, is the following: set F = 1 (F = 0) if there is an 
even number of agents which utility exceeds some threshold and the social alternative is A (B), and F = (F = 1) 
otherwise. 

9 If, however, all agents have private reactions then this information is useless to the agents and we do not require 
such a public disclosure of the agents' announcements. 
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alternative and a subset of reactions for each agent. In the second stage of the game each agent, 
knowing the strategy tuple of all agents, the vector of announced types, the social alternative and 
her available set of reactions, must choose one such reaction. Let Wi : Tj — > Tj denote the 
announcement of agent i, given his type and let W = (Wj)™ =1 . Upon the announcement of the 
social alternative s, the vector of opponents' announcements, t-i and a subset of reactions, Ri C 
Ri, the rational agent will choose an arbitrary optimal reaction, rj((tj, Wz)lt-i)), s, Ri), where 
Wzl(t-i) denotes the pre-image of W_i at the vector of announcements t_jLj 

Thus, given a mechanism and a vector of announcement functions, (Wi)f =1 , the agents' reac- 
tion are uniquely defined. Therefore, we can view (Wj)^ as the agents' strategies, without an 
explicit reference to the choice of reactions. Given a vector of types, t, and a strategy tuple W, the 
mechanism M induces a probability distribution, M(W(t)) over the set of social alternatives and 
reaction tuples. The expected utility of i, at a vector of types t, is E M f W r t ^Ui(t, s, r^), where r, is 
short-writing for the optimal reaction, which itself is determined by M and W. In fact, hereinafter 
we suppress the reference to the reactions in our notations and write E M {w(t))Ui(t, s) instead of 
EM(w(t))Ui(t, s, r { ). 

A strategy Wi is dominant for the mechanism M if for any vector of types t £ T, any alternative 
strategy Wi of i and any strategy profile W_i of i's opponents 

EM{(w t {u),w_ x (t^)))Ui{t, s) > E M ((w l (t 1 ),W- l (t_ l ))) u i( t ' s )- (!) 



In words, Wi is a strategy that maximizes the expected payoff of % for any vector of types and 
any strategy used by her opponents. If for all i the strategy Wi(U) = U is dominant then M is 
called truthful (or strategyproof)^ 

A strategy Wi is strictly dominant if it is dominant and furthermore whenever W{ti) ^ W(ti) 
then a strong inequality holds in Equation ©. If Wi(U) = U is strictly dominant for all i then M 
is strictly truthful. 

A strategy Wi is dominated for the mechanism M if there exists an alternative strategy Wi, such 
that for any vector of types t £ T, and any strategy profile W~i of i's opponents, the following 
holds: E Mm ^ ulW _ At _ t)))Ui (t, s) < E M{{ ^ {ti) ^ {t _ i)))Ui (t, s), with a strong inequality holding 
for at least one type vector t. 

Finally, a strategy tuple W is an ex-post Nash Equilibrium if for all i and t £ T and for any 
strategy Wi of player i, E M{W (t))Ui(t,s) > E M{ ^ i{t .^ w _ i{t _. ))) u i {t,s). If {W^U) = t;}™ =1 is an 
ex-post Nash equilibrium then M is ex-post Nash truthful. 



10 We slightly abuse notation as WZ^it-i) may not be a singleton but a subset of type vectors, in which case the 
optimal reaction is not well defined. More accurate notation must involve considering another primitive to the model 
- the prior belief of i over T-i . With such a prior ri ( {U , Wzl {t-i)),s,Ri) denotes the reaction in Ri that maximizes 
the expected utility with respect to the prior belief, conditional on the subset WZ] (t-i)- 

11 Note we do not require a strong inequality to hold on any instance. 
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2.5 Implementation 



Given a vector of types, t, the expected value of the objective function, F, at the strategy tuple W 

is E M (w(t))[F(t,s)}. 



Definition 3 (/3-implementation) We say that the mechanism M /3-implements F in (strictly) 
dominant strategies, for (3 > 0, if for any (strictly) dominant strategy tuple, W, for any t £ T, 

E M (w(t))[F{t, s)] > max s( zsF(t, s) - (3. 

A mechanism M /3-implements F in an ex-post Nash equilibrium if for some ex-post Nash 
equilibrium strategy tuple, W, for any t £ T, EM{w{t)) [F(t, s)] > max s€ sF(t, s) — (3. 

A mechanism M /3-implements F in undominated strategies if for any tuple of strategies, W, 
that are not dominated and for any t £ T, EM{w{t)) [F(t, s)] > max s£ sF(t, s) — 0. 



Main Theorem (informal statement): For any (/-sensitive function F and 1 > (3 > there 
exists a number n and a mechanism M which /3-implements F in an ex-post Nash equilibrium, 
whenever the population has more than no agents. If, in addition, reactions are private then M 
/3-implements F in strictly dominant strategies. 



3 A Framework of Approximate Implementation 



In this section we present a general scheme for implementing arbitrary objective functions in large 

societies. The convergence rate we demonstrate is of an order of magnitude of \J^p-- O ur scheme 
involves a lottery between two mechanisms: (1) The Exponential Mechanism, a non-imposing 
differentially-private mechanism that randomly selects a social alternative, s. The probability of 
choosing s is proportional to (a exponent of) the value it induces on F; and (2) The Commitment 
Mechanism, where imposition is used to commit agents to take a reaction that complies with their 
announced type. 



3.1 The Exponential Mechanism and Differential Privacy 



Consider the following non-imposing mechanism, which we refer to as the Exponential Mecha- 
nism, originally introduced by McSherry and Talwar ll22l : 

p neF(t,s) 



V P neF(t,s) ' 
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The Exponential mechanism has two notable properties, as we show below: It provides e- 
differential privacy, i.e., for all i it is insensitive to a change in ij. And, it chooses s that almost 
maximizes F(t, s). 

We follow Dwork et al |[T2l and define: 

Definition 4 [e-differential privacy] A mechanism, M, provides e-differential privacy if it is non- 
imposing and for any s G S, any pair of type vectors t,t G T, which differ only on a single 
coordinate, M(t)(s) < e e ■ M(i)(s) 
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In words, a mechanism preserves e-differential privacy if, for any vector of announcements, a uni- 
lateral deviation changes the probabilities assigned to any social choice s G S by a (multiplicative) 
factor of e e , which approaches 1 as e approaches zerojll 

Lemma 1 (McSherry and Talwar 112210 If F is d-sensitive then M^(t) preserves e-differential 
privacy. 

The proof is simple, and is provided for completeness: 

Proof: Let t and i be or two type vectors that differ on a single coordinate. Then for any s G S, 

Fit, s)-i< F(i s) < Fit, s) + i, hence, 

ncF(t,s) neF(t,a) 
e 2d e 2d 



mi F(t.s) neF(t.s) 



ntiF(i,s) 



neF(t,s) 



~2ir 



s6S ' 



QED 

The appeal of mechanisms that provide e-differential privacy is that they induce near indiffer- 
ence among all strategies, in the following sense: 

Lemma 2 If M is non-imposing and provides e-differential privacy, for some e < 1, then for any 
agent i, any type tuple t, any strategy tuple W, and any alternative strategy for i, Wi the following 
holds: 

\E M (W(t))[Ui(t,s)] - ^Af(W l (t i ),H/_ I (i_ l ))[ M ^ t ' S )]l < 2e - 



12 For non discrete sets of alternatives the definition requires that ^{^-Sfl < e e V5 C S. 

A/(t)(S) - 

13 The motivation underlying this definition of e-differential privacy is that if a single agent's input to a database 
changes then a query on that database would result in (distributionally) similar results. This, in return, suggests that it 
is difficult to learn new information about the agent from the query, thus preserving her privacy. 
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The proof is simple, and is provided for completeness: 

Proof: Let W and W be two strategy vectors that differ the i'th coordinate. Then for every 
t e T, s e S, n e Ri and Ui : T x S x E4 ->■ [0, 1] we have 

E Mm t))[ui{t,s)\ = ^M(W(t))(5)-Ui(t,s) 

< ^ e e • M(^), W-i(U))(s) ■ Ui(t, s) 

= e ' ' E W i {U)yV- i {t- i ))l U i( t i S )]' 

where the inequality follows since M provides e-differential privacy, and Ui is non-negative. A 
similar analysis gives 

£7 Wi(t i ),w_ i (t_ i ))[ w *( t ' s )] - e ' ' £ MWt))K(M)]- 

Hence we get: 

#M(Ty(t))kO, s)] - ^(^.(^^.(i,.))^, S )] - ( e * ~~ X ) ' E M(W i (t i ),W- i (t- i ))[ U i( t i S )] 

< e e -l, 

where the last inequality holds because returns a values in [0, 1]. Similarly, 

E M(W i (t i ),W- i (t- i ))[ U i( t > S )) ~ E M(W(t))[Ui(t, s)] < e 6 - 1. 

To conclude the lemma, note that (e e — 1) < 2e for < e < 1. 
QED 

McSherry and Talwar E21 note in particular that in the case of private values truthfulness is 
2e-dominant, which is an immediate corollary of Lemma[2l They combine this with the following 
observation to conclude that exponential mechanisms approximately implement F in e- dominant 
strategies: 

Lemma 3 (McSherry and Talwar Il22l0 Let F : T n x S — > [0, 1] be an arbitrary d-sensitive 
objective function andn > Then for any t, E M ^^[F(t, s)] > max s F(t, s) — ^ In (^jj^j- 

Proof: Let 5 = gin (^). As n > we conclude that In > lne > and, in 

particular, 5 > 0. 
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Fix a vector of types, t and denote by S = {s £ S : F(t, s) < max s F(t, s) — 5}. For any 
s E S the following holds: 

n<zF(t,s) ne(max s F(t,s) — 5) 

M2df+VS^ = < = p~2d d 

1V1 nt F(t,s') — n £ max s F(t,s) C 



Therefore, M^(t)(S) = J2s&s M&(t)(s) < \S\e~^ 5 < \S\e~^ 5 . Which, in turn, implies: 

E M & (t) [F(t,s)] > (maxF(t,s)-6)(l - \S\e~^ 5 ) > maxF(t,s) -5-\S\e~^ & . 



Substituting for 5 we get that 



^ m \ 2d, /ne|S1\ 2d 

^ m W> s )] ^ max F (*> s ) - — ln 



M2d(t)L v > yj - s v > y ne \ 2d I ne 



In addition, n > which implies ln (j^j > i n ( e ) = i ? an d hence g < gin (^). 

Plugging this into the previous inequality yields E M ^^ [F(t, s)] > max s F(t, s) — ^ ln ^^^^ J 
as desired. 

QED 

Note that lim^oo f^pl = whenever the parameters d,e and \S\ are held fixed0 
Therefore, the exponential mechanism is almost optimal for a large and truthful population. 



Remark: There are other mechanisms which exhibit similar properties to those of the Expo- 
nential Mechanism, namely 'almost indifference' and 'approximate optimality'. The literature on 
differential privacy is rich in techniques for establishing mechanisms with such properties. Some 
techniques for converting computations into e-differentially private computations without jeopar- 
dizing the accuracy too much are the addition of noise calibrated to global sensitivity by Dwork et 
al. Ifl2l . the addition of noise calibrated to smooth sensitivity and the sample and aggregate frame- 
work by Nissim et al. Il24l . The reader is further referred to the recent survey of Dwork IfTTI . Any 
of these mechanisms can replace the exponential mechanism in the following analysis. 



14 This limit also approaches zero if d, e, \S\ depend on n, as long as d/e is sublinear in n and \S\ is subexponential 
in n. 
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3.2 The Commitment Mechanism 



We now consider an imposing mechanism that chooses s £ S randomly, while ignoring agents' 
announcements. Once s is chosen the mechanism restricts the allowable reactions for i to those that 
are optimal assuming all agents are truthful. Formally, if s is chosen according to the probability 
distribution P, let M p denote the following mechanism: 

Mg(t){s) = P(s) and M p (t)(n(t, s))\s) = 1. 

Players do not influence the choice of s in M p and so they are (weakly) better off being truthful. 

We define the gap of the environment, 7 = g(T, S, A, u), as: 

7 = g(T, S, A, u) = min max (ui(t, s, ri(t, s)) - Ui(t, s, ri((fej, s))) . 

In words, 7 is a lower bound for the loss incurred by misreporting in case of an adversarial 
choice of s £ 5. In non-trivial environments 7 > 0. We say the a distribution P is separating if 
there exists a separating set S 1 C S such that P(s) > for all s £ S. In this case we also say that 
M p is a separating mechanism. In particular let p = min s6 ^ P(s). Clearly one can choose P such 
thatp > . The following is straightforward: 

Lemma 4 If the environment (T, S, A, u) is non-trivial and P is a separating distribution over S 
then Vfo, 7^ ti , t_i, 

EMP(ti,t-i)[ui(t, s,ri(t, s))] > E M p(p. tt _.)[ui(t,s,ri((bi,t-i),s))] + pi . 

If, in addition, reactions are private, then for any i, 7^ ti, t_i and b^: 

E M P(ti,b-i)[ui{t, 8,Ti{U, s))\ > S M p (6 . )6 _.)[Mi(t, s,ri(bi, s))] +P7- 

Proof: For any pair b { ^ t { and for any s £ S Ui(t,s,ri(ti,s)) > Ui(t, s,rj(6j, s)). In 
addition, there exists some s = s(ti,bi), satisfying P(s) > p, for which Ui(t,s,ri(ti,s)) > 
Ui{t,s,ri{bi,s))+^. Therefore, for any i, h ^ U £ T t andfor any E M p^ t _.)[ui{t, s, n(t, s))) > 
E Mr(bi,t-i)[ui{ti s,ri((bi,t-i), s))] +^7 , as claimed. 

Recall that if reactions are private then rj(t, s) = ri(U, s), namely the optimal reaction of an 
agent, given some social alternative s, depends only on the agent's type. Therefore we derive the 
result for private reactions by replacing ri((t», s) with rj(tj, s) on the left hand side of the last 
inequality and rj((6j, s) with riibi, s) on the right hand side. 

QED 

The following is an immediate corollary: 
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Corollary 1 If the environment (T, S, A, u) is non-trivial and P is a separating distribution over 
S then 

1. Truthfulness is an ex-post Nash equilibrium of M p . 

2. If agent i has private reactions then truthfulness is a strictly dominant strategy for i in M p . 

An alternative natural imposing mechanism is that of a random dictator, where a random agent 
is chosen to dictate the social outcome. Similarly, agents will be truthful in such a mechanism. 
However, the loss from misreporting can only be bounded below by -, whereas the commitment 
mechanism gives a lower bound of 7p > ^ , which is independent of the population size. 

3.3 A Generic and Nearly Optimal Mechanism 

Fix a non-trivial environment (T, S, A, u) with a gap 7, separating set S, a d-sensitive objective 
function F and a separating commitment mechanism, M p , with p = min s6 ^ P(s). 

Set M e q (t) = (1 - q)M&(t) + qM p (t). 

Theorem 1 If 'qpj > 2e then the mechanism is ex-post Nash truthful. Furthermore, if agents 
have private reactions then M e is strictly truthful. 

Proof: Follows immediately from Lemmas [2] (set W(U) —U) and HI 
QED 

Set the parameters of the mechanism M^(t) as follows: 
• q = &. 

and consider populations of size n > n , where no is the minimal integer satisfying n > 
max{^ In ( ^jf) , 4^} and > 

Lemma 5 Ifn>n then 
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2. e < p7. 



3. n > 

e|5| 



Proof: Part (1): r^-v > > 1^ which implies n > Plnfra). In addition, n > n > 

Mln(^).Thereforen>gln(^) + gln(n) = gln(^) =► (p T ) 2 >^m(^ 
Taking the square root and substituting for e on the right hand side yields p^y > 2e and the claim 
follows. 



Part (2) follows directly from part (1) 

Ae 2 d \ 4e 2 d 

frf\S\ - p 7 |S| 2 r V" " v^t3|S|- ^ p 7 | 5 | - 



Part (3): n > n > |^ > ^ > In addition n > ^ > ^ which 



implies 1 < In ( ^ffi" ) • Combining these two inequalities we get: \Jn > t== 



2d 



Multiplying both sides by y/n implies n > 



2edy/n _ 2ed 

^i n (M^)| 5 | ~ 

QED 

Using these parameters we set M(t) = Mg(t). Our main result is: 
Theorem 2 (Main Theorem) The mechanism M(t) is ex-post Nash truthful and, in addition, 



it 6 yj -J^ \J In (^^^j -implements F in ex-post Nash equilibrium, for n > n . If agents have 

private reactions the mechanism is strictly truthful and Q^J^^\J In J^^jf^j -implements F in 
strictly dominant strategies. 



Recall that for ex-post Nash implementation we only need to show that one ex-post Nash 
equilibrium yields the desired outcome. 

Proof: Given the choice of parameters e and q then, Theorem[T]guarantees that M(t) is ex-post 
Nash truthful (and truthful whenever reactions are private). Therefore, it is sufficient to show that 
for any type vector t, 



E £m (F(t, *)) > max F(t, s) - 6 W J- Jin ( 



V p~/n \l \ 2d 
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Note that as F is positive, E m pm [F(t, s)] > and so 

E m [F(t,s)] > (l-q)E uMt) [F(t, 8 )]. 

By part (3) of Lemma [5] we are guaranteed that the condition on the size of of the population of 
Lemma[3]holds and so we can apply Lemma[3]to conclude that: 

'ne\S[ 



( Ad fi 

E m [F{t,s)\ >(l-q) \ maxF(t,s)-—]n f- 



2d 



We substitute q with 1^ and recall that max s F(t, s) < 1. In addition, part (1) of Lemma [5] 
asserts that I s < 1. Therefore 

F * > maxF(t, s) — In — LI > max F t, s - In L^U 

w s ne \ 2a / s p^ ne \ 2d J 

where the last inequality is based on the fact e < pj, which is guaranteed by part (2) of Lemma[5] 



Substituting e for J^Jln t 1 ^ 1 ) we conclude that 




£jfr(t)[ F Ml >maxF(t )S )-2 

and the result follows. 
QED 

One particular case of interest is the commitment mechanism M u , where U is the uniform 
distribution over the set S: 

Corollary 2 Let n be the minimal integer satisfying n > maxj^Li In (^) , and ln "^ ) > 
^j^. 77?en f/ze mechanism M u (t) 6<i/ ^j^-i/ln (^) -implements F, in ex-post Nash equilib- 
rium, for all n > Uq. If agents have private reactions the mechanism M u (t) 6-y/^-y/ln (^j)- 
implements F in strictly dominant strategies. 

Proof: P = U implies that the minimal probability is p = t4. Plugging this into Theorem [2] 
gives the result. 

QED 

Holding the parameters of the environment d, 7, \S\ fixed the approximation inaccuracy of our 
mechanism converges to zero at a rate of \J^^-- 

In summary, by concatenating the exponential mechanism, where truthfulness is e-dominant 
with the commitment mechanism we obtain a strictly truthful mechanism. In fact, this would hold 
true for any mechanism where truthfulness is e-dominant not only the exponential mechanism. 
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4 Applications 



We now turn to demonstrate the generic results in two concrete applications. 



4.1 Monopolist Pricing 



A monopolist producing digital goods, for which the marginal cost of production is zero, faces a 
set of indistinguishable buyers. Each buyer has a unit demand with a valuation in the unit inter- 
val. Agents are arranged in (mutually exclusive) cohorts and the valuations of cohort members 
are correlated. Each agent receives a private signal and her valuation is uniquely determined by 
the signals of all her cohort members. The monopolist wants to set a uniform price in order to 
maximize her average revenue per user0 

Assume there are N ■ D agents, with agents labeled (n, d) (the d th agent in the n th cohort). 
Agent (n, d) receives a signal X% 6 R and we denote a cohort's vector of signals by X n = 
{X2}d =v We assume that the valuation of an agent, V£, is uniquely determined by the signals of 
her cohort members; V£ = V£{X n ). 

We assume that each agent's signal is informative in the sense that V^(X n ) > V£{X n ) when- 
ever X n > X n (in each coordinate a weak inequality holds and for at least one of the coordinates 
a strong inequality holds). That is, whenever an individual's signal increases the valuation of each 
of her cohort members increases. 

Let Rt n ,d) — {'Buy', 'Not buy'} be the set of reactions for agent (n, d). 

The utility of (n, d), given the vector of signals X = {X n }^ =1 = {{X^}f =1 }^ =1 , and the price 
p, is 

V d n (X n )-p ifr M) = 'Buy', 
if r (M) = 'Not buy'. 



U( n ,d)(X,p,r {n4) ] 



We assume that all valuations are restricted to the unit interval, prices are restricted to some 
finite grid S — S m — {0, ^, ^, . . . , 1} (hence, \S\ — m + 1), and X% takes on only finitely many 
values. We assume the price grid is fine enough so that for any two vectors X n > X n there exists 
some price p e S such that E(V n \X n ) > p + ^ > p > E(V n \X n ). Therefore for vector of 
announcements there exists a maximal price for which optimal reaction is Buy. For that price, if 
an agent announces a lower value then the best reaction would be Not Buy, which will yield a loss 
of ^ at least. Similarly, there exists the lowest price for which the optimal reaction is Not Buy. 

15 To make this more concrete one can think of the challenge of pricing a fire insurance policy to apartment owners. 
Each apartment building is a cohort that shares the same risk and once the risk is determined (via aggregation of 
agents' signals) each agent has a private valuation for the insurance. 
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Announcing a higher value will result in the optimal reaction being Buy, which yields a loss of — 
at least. We conclude that the gap is 7 = — . 

The monopolist wants to maximize F(t,p) = jfe ■ |{(n, d) : V^(X n ) > p}\, the average 
revenue per buyer. Note that a unilateral change in the type of one agent may change at most the 
buying behavior of the D members in her cohort, resulting in a change of at most < in the 
average revenue. As the population size is ND we conclude that F is D-sensitive. 

Let M dg be a mechanism as in Corollary [21 where a Uniform Commitment mechanism is used: 
Corollary 3 For any D there exists some N such that for all N > N the mechanism M^g 



The literature on optimal pricing in this setting has so far concentrated on the private values 
case and has provided better approximations. For example, Balcan et al. 0, using sampling 
techniques from Machine Learning, provide a mechanism that 0(A=) -implements the maximal 
revenue without any restrictions to a grid. 



A Multi Parameter Extension: In the above setting we assumed a simple single-parameter type 
space. However, the technique provided does not hinge on this. In particular, it extends to more 
complex settings where agents have a multi-parameter type space. More concretely, consider a 
monopolist that produces G types of digital goods, each with zero marginal cost for production. 
There are N buyers, where each buyer assigns a value, in some bounded interval, to each subset 
of the G goods (agents want at most a singe unit of each good). The monopolist sets G prices, 
one for each good, and once prices are set each agent chooses his optimal bundle. The challenge 
of the monopolist is to maximize the average revenue per buyer. In this model types are suffi- 
ciently diverse. In fact, for any two types there exists a price vector that yields different optimal 
consumptions. Therefore, the scheme we provide applies just as well to this setting. 



4.2 Facility Location 

Consider a population of n agents located on the unit interval. An agent's location is private 
information and a social planner needs to locate K similar facilities in order to minimize the 
average distance agents travel to the nearest facility^ We assume each agent wants to minimize 
her distance to the facility that services her. In particular, this entails that values (and reactions) are 
private. We furthermore assume that agent and facility locations are all restricted to a fixed finite 

l6 For expositional reasons we restricting attention to the unit interval and to the average travel distance. Similar 
results can be obtained for other sets in R 2 and other metrics, such as distance squared. 




ln(— )) -implements F in ex-post Nash equilibrium. 
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grid on the unit interval, L = L{m) = {0, , 1}. Using the notation of previous sections, 

let Tj = L, S = L K , and let Ri = L. The utility of agent i is 



\U -Ti\ if Ti G s, 

— 1 otherwise. 



Hence, r^bi, s) is the facility closest to the locations of the facility in s closest to 6j. Let F(t, s) = 
- YH=i u i{tii s i r i{U, s)) be the social utility function, which is 1-sensitive (i.e., d = 1). 

First, consider the uniform commitment mechanism M u , which is based on the uniform dis- 
tribution over S for the commitment mechanism. Now consider the mechanism Mloci, based on 
the uniform commitment mechanism, as in Corollary [2] 



Corollary 4 3n such that\/n > n the mechanism Mloci Qy m( - m ^ yln (^)- implements 
the optimal location in strictly dominant strategies. 

Proof: Note that j — —, \S\ = (m + 1) K and the proof follows immediately from Theorem[2] 
QED 

Now consider an alternative commitment mechanism. Consider the distribution P, over S = 
L K , which chooses uniformly among all the following alternatives - placing one facility in location 
i- and the remaining K — 1 facilities in location — , where j — 0, . . . , m — 1. Note that for any i, 
any pair bi ^ ti is separated by at least one alternative in this set. For this mechanism p — — . Now 
consider the mechanism M LO c2, based on the commitment mechanism, M p : 



Corollary 5 3n such thatMn > n Mloc2 ^ty m { ^^^~ j -implements the optimal location 
in strictly dominant strategies. 



Proof: In analogy to the proof of Theorem [2l setting e = In an d q = lew? . 

QED 

For both mechanisms the approximation error converges to zero at a rate proportional to 1/ y/n 
as society grows. In addition, the approximation error of both mechanisms grows as the grid size, 
m, grows. However in the second mechanism approximation deteriorates at a substantially slower 
rate. 
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5 Large Type Sets 



The arguments underlying the generic approximate optimal mechanism for a finite number of 
social alternatives do not generally extend to models where the type set is large. However, in 
concrete models, where additional structure is assumed, such an extension may be possible. We 
demonstrate this in the facility location problem introduced in the previous section. 

As before, we assume that each player is located on the unit interval and that her location 
is private information. Formally, set T = [0,1]. A mechanism must (randomly) decide on the 
location of K facilities in the unit interval. Let S = [0, l] K and consider the standard Borel a- 
algebra which we denote S. The objective of the designer is to minimize the average distance a 
player must travel to a facility. Formally, the designer seeks to minimize F(t, s) = - X^Li \U ~ 
Ti(ti, s)|, where r^tj, s) denotes the facility in s that is closest to tj. 

We use a continuous version of the Exponential Mechanism, where the probability of any event 
S G S is given by: 

r neF{t,s) J 

We say that a mechanism M provides e-differential privacy if ^-wg| < e e WS G S and for any 

M(t)(b) 



pair of type tuples, t and t, that differ on a single entry. McSherry and Talwar 11221 prove the 
following (which is analogous to lemma [[]): 

Lemma 6 (McSherry and Talwar Il22l0 If F is d-sensitive then M^(t) preserves e-differential 
privacy. 



The proof is identical to that of Lemma[T]and is therefore omitted. 



5.1 The approximation accuracy of the Exponential Mechanism 

The solution concept we pursue in this section is deletion of dominated strategies. In fact, what we 
show in the sequel is that being truthful dominates significantly mis-reporting one's type. Thus, 
deletion of dominated strategies implies that agents resort to strategies that are 'almost' truthful. 

Consequently, we turn to study the approximation accuracy of the Exponential Mechanism 
whenever agents slightly mis-report their types. We begin by considering truthful agents. 

To state the next lemma we introduce the following notation. For < a < 1 let S a — S a (t) = 
{s G S : F(t, s) > max s F(t, s) — a}, and S a = S a (t) = S \ S a . Let fi denote the uniform 
probability over S. 
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Lemma 7 (McSherry and Talwar |22|) If a > In ( ^^f ) ^en £ M ^ (t) [F(t, s)] > max, F(t, s)- 



3a. 



We include the proof for completeness. 
Proof: Note first that 

_ „ ntF(t,s) _ 

M2d(t)(So„) h e 2d ds 



M*(t){S a ) j e^ds 



— — — — , . — — ; — e M ■ — , — , 2 



e ^ f (M,-., ds ^ (5a) - ^ Sa y 

where the first inequality follows from M^(t)(S a ) < 1, the second inequality follows from the 
definition of S>2a and S a , and the third inequality follows from fx(S2 a ) < 1- Hence, we get that 

— nea. 

M^d(t) returns s £ S 2a with probability at least 1 — 6 , > 1 % . . Hence, 

01 

E m*®\- F & s )l ^ (™* F (t, s) - 2a)(l - maXsF( ^ g) ) > maxF(t, s) - 3a. 



QED 

This result enables us to prove the following: 
Corollary 6 [F(t, s)} > max, F(t, s) - £ In (e + (ne) A ' +1 ). 



Proof: Fix a tuple of players' locations t £ T n and let s denote the alternative in S that 
minimizes F(t, s). For any a > 0, if s £ [0, 1] A satisfies max fe |s fe — Sk\ < a then s £ S^. To see 
this note that 



1 " 

F(t,s') = -Y / Ui(-ti,s',r i (t i ,s')) 

i=l 

1 - 

< - s',ri(ti, s)) 

i=l 
1 ™ 

- s)) + 



< — > ( s,ri(ti, s)) + a] 
n . 

< F(t,s') + a. 



22 



Therefore, whenever a < 0.5, fi(S a ) > a K . 

Set a = ^ln (e + (ne) K+1 ). We argue that a > ^ In ( ^^py^ J which implies that we 

can apply Lemma [7] To see this recall that max s F(t, s) < 1, and using our bound on fi(S a ) it 
suffices to show that (ne) K+1 > l/a K+1 , which indeed is the case as a > 1/ne. By Lemma [7J 
E Mi(t) [F(t, s)} > max s F(t, s) - £ In (e + (ne)^ +1 ), as required. 

QED 

We now turn to analyze the case where agents misreport their location. 
Lemma 8 

• \F(bi,t-i, s) - F(ti,t-i, s)\ < ±\ti - bi\; and 

• \F(b, s) — F(t, s)\ < mctXi\ti — 



Proof: To derive the first part note that 

-Ui(bi, s,ri(bi, s)) = \bi - r^, s)\ < % - r^U, s) \ = \h - U + U - r^U, s)\ 
< \h -U\ + \U -ri(U,s)\ = \bi -U\ -Ui(ti,s,ri(ti,s)), 

and (by a similar analysis) -Ui(U, s,ri(U,s)) < \bi-ti\-Ui{b h s,ri(b h s)). Hence, \ui(bi, s,ri(b h s))- 
Ui(ti,s,ri(ti,s))\ < | k -U\ and we get that 

\F(bi,t-i, s) - F(ti,t_i, s)\ = -\ui(bi, s,ri(bi, s)) - u^U, s,ri(ti,s))\ < -\U - hj\. 



The second part follows by iteratively applying the first part for n times. 



QED 



Lemma 9 If \hi — U\ < (3 for all i then | max s F(t, s) — max s F(b, s)\ < f3. 



Proof: Let s t G argmax s {F(t, s)} and s b G argmax s {F(b, s)}. Using triangle inequality, 

\U - hi + \bi - n(bi, s b )\ > \U - ri(bi, s b )\, and noting that \U - n(bi, s b )\ > \U - n(ti, s b )\ we 
get that 

\U - h\ + \bi - n(bi, s b )\ > \u - n(ti, s b )\. 
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Hence, 

^ n 1 n 

-J^-(\ti-k\ + 7^,56)1) < -Y"-|ti-ri(^,s 6 )| = F(t,s b ) <F(t,a t ). 

i=l i=l 

Noting that ± £)" =1 -|&» - r^&i, s 6 ) | = F(&, s 6 ) we get that 

1 n 

F{b,s b )-F{t,s t ) < -22\U-1h\ <p. (2) 

i=l 

A similar argument yields 

F{t, s t ) - F{b, s b ) < f3. (3) 
Combining inequalities [2] and [3] we conclude that 

| max F{t, s) - max F{b, s) \ = \F(t, s t ) - F{b, s b ) \ < 0, 

s s 

as claimed. 
QED 

Lemma 10 If \b~U\ < f3 for alii then E M %,jF(t, s)] > max s F(t, s )-2/3-£ In (e + (ne) K+1 ) 

Proof: For any finite set of locations s C [0,1], traveling from ti to the point closest to ti in s 
is not longer than a taking a detour via bi, and then traveling from bi to the point closest to bi in s, 
i.e., \U - n(ti, s)\ < \U - bi\ + \h - ri(bi, s)\. Therefore, 



1 n 

j=l 

By Corollary |6l 

E Mf {b) [F(b, s)} > maxF(&, a ) - £ In (e + (ne) K+1 ) . 

By Lemma [9l 

max F(b, s) > max s) — (3. 

s s 

Combining all three inequalities above gives: 

E Mi{b) [F{t, s)\ > maxF(t, s) - 2(3 - A hi ( e + ( ne )* +1 ) , 

as claimed. 
QED 
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5.2 Deviations from truthfulness in the Exponential Mechanism 

We bound the potential gain of an agent located at t { who reports hi. 

Lemma 11 Using the Exponential Mechanism for the facility location problem, ife<\ then for 
any i, any b^ i$ G Tj and any t_i G T_,,, 

£ MJ(f)„u)f tt! ^' ,s ' ri ^'^l ~ E Mi {u,t-i) 5 > r i(*<> 5 ))] - 2e l*»- hi- 
proof: By Lemma[8l s) — F(U,t-i, s)\ < — Plugging this into the definition 
of the Exponential Mechanism we get: 



The proof is completed by noting that as \U — bi\ < 1 and e < 1, bi ' < 1 + 2e\U — bi 
QED 



5.3 A commitment mechanism 

Consider a commitment mechanism induced by the following distribution P over the set S = 
[0, 1} K : First, choose a uniformly a random integer X G {1, 2,3,..., m}, where the parameter m 
will be set below. Next choose a number Y, randomly and uniformly, from the interval [0, 2 X — 1]. 
Now let s be the alternative where one facility is located at ^ and the other K — 1 facilities at 

Y+l 



E 




M5(ti,t_i) 



[ui(ti,s,ri(ti,s)], 



Lemma 12 If\bi-U\ > 2 (* ^ Sji^fe.i-oM*^ s)] > ^(^^^^(^s)] + 
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Proof: We first consider the case 6j < t— 2 ( m 1 K Assume X and Y are chosen such that < 
l fi ~ &< ! < and ^ G ^p-]. As a result the facility assigned to i, whenever she announces hi 
is located at However, if she announces her true location, ti, she is assigned a facility located 
at Consequently, it^, s, r^, s)) > Uifc, s,Ti{h u s)) + > s, r^&j, s)) + S^M. In 
words, for the specific choice of X and Y misreporting one's type leads to a loss exceeding ( ti ~ bi \ 

The probability of choosing the unique X satisfying < 2 — is 1/ m. Conditional on 
this event, the probability of choosing Y satisfying X- G ^±^] is . Since the mechanism 
is imposing, then for an arbitrary choice of X and Y misreporting is not profitable. Therefore, the 
expected loss from misreporting exceeds ^ • 

The proof of the complementary case, hi > ti + 2~( m ~ 1 > , uses similar arguments and is omitted. 

QED 

5.4 Implementation in undominated strategies 

As in the generic construction, let M q (t) = (l-q)M%(t)+qM p (t). Note that whenever q lu ~^ 2 > 
2e\ti — hi\ being truthful dominates any announcement satisfying \b{ — U\ > 2~ (ja ~ 1 \ In particular, 
this holds whenever q > 16em2 m . 

Set e = ^73 y/K + 1, fh = [log ( 6v ^ lnTO )l, and q = 16em2™ and denote by M LOC 3 = M e q 
for this choice of parameters. 



Theorem 3 There exists n = n (K) such that Mlocz 32 ^i% +1 In n-implements F in undomi- 
nated strategies for all n > n . 

Proof: We first observe that as there exists n q = n q (K) such that q < 1 for all n > n q and 
hence the mechanism is well defined. This also implies that for agent i reporting hi such that 
\h — U\ > 2~( m_1 ) is dominated by reporting ti. Similarly, there exists n a = n a (K) such that 
a = ^ In (e + (ne) x+1 ) < 0.5 for all n > n a as required in the proof of Corollary [6l Finally, 
there exists rim = n m (K) such that fh < In n for all n > n m . In the following we will assume that 
n > max(n ? ,n Q ,n^). 

There are two sources for the additive error for Mlocz- 

1. The commitment mechanism introduces an additive error of at most q = 8em2 m . Noting 
that 2* < 2 • 6v ^ lnra and substituting for e we get that q < § < In n. 
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2. The exponential mechanism introduces an additive error of 2 _ ( ^_ 1) + ^ln (e + (ne) K+1 ) 

(see Lemma [TOl). Note that In (e + (ne) x+1 ) < In (e + ne) and substituting for e, 

we get that there exists n 1 = ni(K) such that for all n > n\ this additive error is bounded 

by 2 _ ( Ld + ^^{w 1 Inn. In addition 2™" 1 = | ■ 2 m > \^K+l\nn which im P lies that the 

error is bounded by 4 • ln n + ln n = ln n - 

Setting n = max(n 9 , n a , n m n\), we get that for all n > n the total additive error is bounded 

by 

2VF+T, SOv/FTl, 32V/FTI, 
— In n H -7- In n = In n. 

n l/6 n l/6 n l/6 

QED 



6 Discussion 

The mechanisms proposed in this paper are based on two pillars - a differentially private mecha- 
nism on the one hand and an imposing mechanism on the other hand. In the following we discuss 
the importance of each of these pillars for the results obtained. In addition, we discuss some of the 
limitations of our results. 



6.1 Is differential privacy sufficient? 



McSherry and Talwar [|22| observed that differential privacy is sufficient to yield approximate 
implementation in e-dominant strategies. However, as we show below, differential privacy does 
not generally imply implementation with a stronger solution concept. 

Our example is a pricing mechanism that utilizes the exponential mechanism and hence yields 
an e-dominant implementation that (assuming parties act truthfully) well approximates the optimal 
revenue. However, there are dominant strategies in the example that involve mis-representation 
and lead to a significantly inferior revenue. 

Example 2 Consider a monopolist producing an unlimited supply digital good who faces n buy- 
ers, each having a unit demand at a valuation that is either 0.5 + \i or 1 + \i where < fi < 0.5. 
The monopolist cannot distinguish among buyers and is restricted to choosing a price in the set 
{0.5, 1}. Assume the monopolist is interested in maximizing the average revenue per buyer\^\ The 
optimal outcome for the auctioneer is hence 



OPT (I) 



max sg{0 . 5il} (s • \{i : U > s}\) 



n 



17 We consider the average revenue per buyer as the objective function, instead of the total revenue, in order to 
comply with the requirement that the value of the objective function is restricted to the unit interval. 
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If the monopolist uses the appropriate exponential mechanism then it is e-dominant for agents 
to announce their valuation truthfully, resulting in an almost optimal revenue. However, one should 
note that the probability that the exponential mechanism will choose the lower of the two prices 
increases with the number buyers that announce 0.5. Hence, it is dominant for buyers to announce 
0.5. This may lead to inferior results. In particular, whenever all agents value the good at 1 but 
announce 0.5 the mechanism will choose the price 0.5 with high probability, leading to an average 
revenue of 0.5 per buyer, which is half the optimal revenue per buyer. 

6.2 Is imposition sufficient? 

It is tempting to think that our notion of imposition trivializes the result, i.e., that, regardless of 
the usage of a differentially-private mechanism, the ability to force agents to react sub-optimally, 
according to their announced types, already inflicts sufficient disutility that would deter untruthful 
announcements. The next example demonstrates that such a naive imposition is generally insuffi- 
cient. Intuitively, the reason is that for inducing both truthfulness and efficiency, one needs a strong 
bound on an agent's benefit from mis-reporting: the utility from mis-reporting should be smaller 
from the disutility from being committed to a sub-optimal reaction. 

Example 3 Consider a digital goods pricing problem with n agents, where the valuation of each 
agent is either - or 1 + fi, and the possible prices are - and 1. In this example the optimal price 
is 1 whenever there exists an agent of type 1 + fi, fi < 0.5. 

Consider the following mechanism: with high probability it implements the optimal price and 
with a low probability it uses an imposing mechanism. Note that the strategy to always announce a 
valuation of - is a Nash equilibrium. This announcement is clearly optimal if an agent's valuation 
is indeed -. If an agent's valuation, on the other hand, is 1 + /i, then complying with this strategy 
will result in a utility that is almost 1, whereas deviating to truthful announcement will result in a 
price ofl with high probability, hence a utility of /x. 

Therefore, the monopolist's average revenue from a buyer is always -. This is substantially 
inferior to the optimal outcome, which could be as high as 1, whenever all agents are of the high 
type. 

The Nash equilibrium from example [3] survives even if we modify the mechanism to be fully 
imposing (i.e, it always imposes the optimal reaction). Thus, the above mentioned sub-optimality 
holds. 

We believe that the notion of imposition is natural in many settings, and that to some extent 
imposition is already implicitly integrated into the mechanism design literature. In fact, any mech- 
anism that is not ex-post individually rational imposes its outcome on the players: it imposes 
participation and ignores the possibility players have to 'walk away' once the results are known. 
Moreover, models that involve transfers treat these as imposed reactions: once the social choice 
and transfers are determined, players must comply (consider taxation and auction payments as an 
example). 
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6.3 Model Limitations 



There are three overarching limitations to the technique we present: (1) The generic mechanism 
only works for objective functions which are not sensitive, (2) We consider settings where the 
reaction set of agents is rich enough, such that any pair of types can be separated by the optimal 
reaction on at least one social alternative; and (3) The size of the set of social alternatives cannot 
grow too fast as the set of agents grows. We discuss these below. 



6.3.1 Low sensitivity of the objective function 

Many objective functions of interest are actually insensitive and comply with our requirements. 
Revenue in the setting of digital goods, and social welfare (i.e., sum of agents' valuations) are 
typical examples. We note that although we focused our attention on social functions whose sen- 
sitivity is constant (independent of n), one can apply Theorem [2] also in the case where d = d(n) 
as long as — > as n — > oo. 

There are, however, important settings where the objective function is sensitive and hence our 
techniques cannot be applied. An important example is that of revenue maximization in a single 
unit auction - it is easy to come up with extreme settings where a change in a type of a single agent 
can drastically change the revenue outcome. Consider, e.g. the case where all agents value the 
good at zero, resulting in a maximal revenue of zero. A unilateral change in the valuation of any 
single agent from zero to one will change the maximal revenue from zero to one as well. 

However, even in this case the domain of type profiles (valuation profiles) that demonstrate 
sensitivity is quite small - for instance, if agents valuations are taken uniformly from [0, 1] then 
although the worst-case sensitivity of the maximal revenue is 1, the 'typical' sensitivity would be 
of order 1/n. In this case, the work of Nissim et al. [|24ll may turn to be applicable, as it yields 
differentially private mechanisms where the deviation from the maximum depends on a local notion 
of sensitivity called smooth sensitivity. We leave the examination of this approach to future work. 



6.3.2 Rich reaction set 

The second limitation is the requirement that agents' reaction sets are sufficiently rich. In fact, 
what we need for the results to hold is that for any pair of types of an agent there exists some social 
alternative for which the set of optimal reactions for the first type is disjoint of the set of optimal 
reactions for the second type. For example, in an auction setting, we require that for each pair of 
agents' valuations the auctioneer can propose a price such that one type will buy the good, while 
the other will refuse. 
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6.3.3 Small number of social alternatives 



The approximation accuracy we achieve in Theorem [2] is proportional to J ■ Note that 

p > 1/151. A naive use of the theorem yields accuracy 0(\S\\nn/n), yielding meaningful ap- 
proximation as long as \S\ (as a function of n) grows slower than n/ Inn. 

As we have demonstrated in sections H31 one can sometimes design a commitment mechanism 
realizing a much bigger p, ideally independent of |5|. If that is the case, then Theorem [2] yields 

approximation error O(y^^p^), allowing the number of social alternatives to be as high as an 
exponential function of the number of agents. For larger S, the approximation error may not 
vanish as n increases. Two interesting examples for such settings are matching problems, where 
each social alternative specifies the list of pairs, and multi unit auctions where the number of goods 
is half the number of bidders. 



6.4 Alternative mechanisms 



The framework we presented combines a differentially private mechanism with an imposing one. 
Our general results refer to a 'universal' construction of an imposing mechanism (the uniform one), 
yet the specific examples we analyze demonstrate that imposing mechanisms that are tailor made 
to the specific setting can improve upon the results. 

Similarly, it is not imperative to use the Exponential mechanism as the first component, and 
other differentially-private mechanisms may be adequate. In fact, the literature on differential 
privacy provides various alternatives that may outperform the Exponential mechanism, given a 
specific context. Some examples can be found in Dwork et al. |fl2|. where the mechanism has a 
noisy component that is calibrated to global sensitivity, or in Nissim et al. I1241 where a similar 
noisy component is calibrated to smooth sensitivity. The latter work also uses random sampling to 
achieve similar properties. To learn more the reader is referred to the recent survey of Dwork [fTTI . 
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